Skip to content

Commit 31bddd7

Browse files
ccl0utierccl0utier
committed
Rework after discussing options
1 parent 6f39b2d commit 31bddd7

File tree

1 file changed

+58
-28
lines changed

1 file changed

+58
-28
lines changed

‎default/data/ui/views/attack_range_main_dashboard.xml‎

Lines changed: 58 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,21 @@
88
<earliest>$time_token.earliest$</earliest>
99
<latest>$time_token.latest$</latest>
1010
</search>
11+
<!-- Check if ES is installed, and prefix the ES Analytic Story Link field with "_" if not (which hides it in a table) -->
12+
<search id="BaseESInstalledSearch">
13+
<query>
14+
| rest /services/apps/local
15+
| where title = "SplunkEnterpriseSecuritySuite"
16+
</query>
17+
<finalized >
18+
<condition match=" 'job.resultCount' != 0">
19+
<set token="filterESLink">noop</set>
20+
</condition>
21+
<condition>
22+
<set token="filterESLink">rename view_es as _view_es</set>
23+
</condition>
24+
</finalized >
25+
</search>
1126
<label>Attack Range Dashboard</label>
1227
<description>Shows tests already run and relevant statistics in addition to possible analytic stories for executed tests. Currently supports only Atomic Red tests</description>
1328
<fieldset submitButton="false">
@@ -250,32 +265,41 @@
250265
<row>
251266
<panel>
252267
<title>Potential Analytic stories [$story_count$]</title>
253-
<html><span><b>Note:</b> The &quot;View [ES]&quot; links will ony work if you have Splunk Eterprise Security installed as part of Attack Range.</span></html>
254268
<table>
255269
<search>
256270
<progress>
257271
<set token="story_count">$job.resultCount$</set>
258272
</progress>
273+
<!-- Note: The link to SSE is not used yet - as it's not ready at this point - it's a placeholder for now -->
274+
<!-- Note: The _docs_title field turns the Analytic Story into the HREF Anchor format used in the documentation, for example: Cloud Federated Credential Abuse -> Cloud_federated_credential_abuse.
275+
and also normalizes the field for other fringe cases (duplicate spaces, extra spaces at the end, etc.) -->
259276
<query>`get_attack_data`
260-
|lookup enterprise-attack-lookup Technique
277+
| lookup enterprise-attack-lookup Technique
261278
| eval mitre_id = Technique+" - "+mitre_technique_display, atomic_test= 'Test Number'+"-"+'Test Name'
262279

263280
| join type=left max=0 Technique
264-
[ | rest /services/configs/conf-analytic_stories splunk_server=local count=0
265-
|rex field=mappings ".*,+\s\"mitre_attack\":(?&lt;technique&gt;.*),+\s\"nist\""
266-
|rex field=technique mode=sed "s/\[//g"
267-
|rex field=technique mode=sed "s/\]//g"
268-
| eval technique=split(technique, ",")
269-
|rex field=technique mode=sed "s/\"//g"
270-
| mvexpand technique
271-
| eval Technique=trim(technique)
272-
| where Technique!=""
273-
|fields Technique, title]
274-
275-
|eval view="View [ESCU]"
276-
|eval execute="Execute [ASX]"
277-
|stats dc(title) by title, view, execute
278-
| fields title, view, execute</query>
281+
[
282+
| rest /services/configs/conf-analytic_stories splunk_server=local count=0
283+
| rex field=mappings ".*,+\s\"mitre_attack\":(?&lt;technique&gt;.*),+\s\"nist\""
284+
| rex field=technique mode=sed "s/\[//g"
285+
| rex field=technique mode=sed "s/\]//g"
286+
| eval technique=split(technique, ",")
287+
| rex field=technique mode=sed "s/\"//g"
288+
| mvexpand technique
289+
| eval Technique=trim(technique)
290+
| where Technique!=""
291+
| fields Technique, title
292+
]
293+
| eval view_es="View [ES]"
294+
| eval view_sse="View [SSE]"
295+
| eval view_docs="View [Docs]"
296+
| eval execute="Execute [ASX]"
297+
| eval _docs_title = trim(replace(title, "\s+", " "))
298+
| eval _docs_title = upper(substr(mvjoin(split(lower(_docs_title), " "), "_"),1,1)).substr(mvjoin(split(lower(_docs_title), " "), "_"), 2)
299+
| stats dc(title) by title, _docs_title, view_es, view_docs, execute
300+
| fields title, _docs_title, view_es, view_docs, execute
301+
| $filterESLink$
302+
</query>
279303
<earliest>$time_token.earliest$</earliest>
280304
<latest>$time_token.latest$</latest>
281305
<sampleRatio>1</sampleRatio>
@@ -288,12 +312,20 @@
288312
<option name="rowNumbers">false</option>
289313
<option name="totalsRow">false</option>
290314
<option name="wrap">true</option>
315+
<fields>$result.fieldList$</fields>
291316
<drilldown>
292-
<condition field="view">
317+
<condition field="view_es">
293318
<link target="_blank">/app/SplunkEnterpriseSecuritySuite/ess_analytic_story_details?analytic_story=$click.value$</link>
294319
</condition>
320+
<!--<condition field="view_sse">
321+
<link target="_blank">/app/Splunk_Security_Essentials/TBD?=$click.value$</link>
322+
</condition>-->
323+
<condition field="view_docs">
324+
<link target="_blank">https://docs.splunk.com/Documentation/ESSOC/latest/stories/UseCase#$row._docs_title$</link>
325+
</condition>
326+
<!-- Default link is the documentation -->
295327
<condition field="title">
296-
<link target="_blank">/app/SplunkEnterpriseSecuritySuite/ess_analytic_story_details?analytic_story=$click.value$</link>
328+
<link target="_blank">https://docs.splunk.com/Documentation/ESSOC/latest/stories/UseCase#$row._docs_title$</link>
297329
</condition>
298330
<condition field="execute">
299331
<link target="_blank">/app/Splunk_ASX/execute?form.mode=now&amp;form.time.earliest=-24h@h&amp;form.time.latest=now&amp;form.story=$row.title$</link>
@@ -309,16 +341,14 @@
309341
<set token="detection_count">$job.resultCount$</set>
310342
</progress>
311343
<query>`get_attack_data`
312-
| rename Technique as mitre_technique
344+
|rename Technique as mitre_technique
313345
| join type=left max=0 mitre_technique
314-
[
315-
| sseanalytics
316-
| search mitre_id!="None"
317-
| mvexpand mitre_id
318-
| rename mitre_id as mitre_technique
319-
]
320-
| stats dc(name) by name,mitre_technique,channel
321-
| table name, mitre_technique, channel</query>
346+
[| sseanalytics
347+
|search mitre_id!="None"
348+
|mvexpand mitre_id
349+
|rename mitre_id as mitre_technique]
350+
|stats dc(name) by name,mitre_technique,channel
351+
|table name, mitre_technique, channel</query>
322352
<earliest>$time_token.earliest$</earliest>
323353
<latest>$time_token.latest$</latest>
324354
<sampleRatio>1</sampleRatio>

0 commit comments

Comments
 (0)